linux-kernel - Re: kernel BUG at include/linux/mm.h:699

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20200420150658.GR27314@dhcp22.suse.cz>
Date:   Mon, 20 Apr 2020 17:06:58 +0200
From:   Michal Hocko <mhocko@...nel.org>
To:     Hillf Danton <hdanton@...a.com>
Cc:     syzbot <syzbot+a923008018a2d298247b@...kaller.appspotmail.com>,
        akpm@...ux-foundation.org, linux-kernel@...r.kernel.org,
        Minchan Kim <minchan@...nel.org>,
        Johannes Weiner <hannes@...xchg.org>, linux-mm@...ck.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: kernel BUG at include/linux/mm.h:699

On Mon 20-04-20 12:15:33, Hillf Danton wrote:
> 
> Sun, 19 Apr 2020 08:28:14 -0700
> > syzbot found the following crash on:
> > 
> > HEAD commit:    8632e9b5 Merge tag 'hyperv-fixes-signed' of git://git.kern..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=11ac6be0100000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=5d351a1019ed81a2
> > dashboard link: https://syzkaller.appspot.com/bug?extid=a923008018a2d298247b
> > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > 
> > Unfortunately, I don't have any reproducer for this crash yet.
> > 
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+a923008018a2d298247b@...kaller.appspotmail.com
> > 
> > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
> > page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)

This looks like a page reference count underflow. If there is a
reproducer then page_owner might help to tell who was the last owner.
[...]
 
> Flush TLB every chance before we get every thing done.
> 
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -1080,8 +1080,8 @@ again:
>  			page_remove_rmap(page, false);
>  			if (unlikely(page_mapcount(page) < 0))
>  				print_bad_pte(vma, addr, ptent, page);
> +			force_flush = 1;
>  			if (unlikely(__tlb_remove_page(tlb, page))) {
> -				force_flush = 1;
>  				addr += PAGE_SIZE;
>  				break;
>  			}
> @@ -1146,10 +1146,9 @@ again:
>  		tlb_flush_mmu(tlb);
>  	}
>  
> -	if (addr != end) {
> -		cond_resched();
> +	cond_resched();
> +	if (addr != end)
>  		goto again;
> -	}
>  
>  	return addr;
>  }
 
This patch doesn't make any sense to me wrt to the above report. What
are you trying to achieve?

-- 
Michal Hocko
SUSE Labs